Pwn2own on CuraSec

Pwn2Own Ireland 2026: $1.26M paid for 98 zero-days

Fri, 09 Oct 2026 17:26:04 +0000

Engineer — Learn: Contest zero-days are under responsible-disclosure embargo until vendors patch; monitor vendor advisories over the coming weeks for products you run, especially edge devices and browsers commonly targeted at Pwn2Own.
SOC/IR — Skip
Leader — Learn: Useful data point for board-level discussions on software attack surface breadth; no specific vendor or product is named in available reporting, so no vendor-risk action is warranted yet.

Fri, 09 Oct 2026 17:26:04 +0000

Engineer — Learn: Remote code execution on a fully patched Pixel 10 is noteworthy research, but no patch or public PoC is available yet and mobile handsets are outside the typical cloud/AppSec engineering stack; monitor Google’s security bulletins for patches once they drop.
SOC/IR — Learn: Contest rules channel these exploits to the vendor privately, so there are no IOCs, public TTPs, or active exploitation signals to hunt; file as background awareness of Pixel attack surface until Google publishes details.
Leader — Learn: A controlled competition result with no active exploitation; if the org manages a corporate Pixel fleet, note that remote compromise of fully patched devices is now demonstrated and watch for Google’s patch announcement to assess MDM policy response.

Thu, 08 Oct 2026 17:51:36 +0000

Engineer — Learn: Pwn2Own findings highlight zero-day surface on Android/Samsung devices, but no CVEs, patches, or PoCs are public yet; monitor Samsung’s coordinated disclosure process for any vulnerabilities affecting enterprise mobile deployments.
SOC/IR — Skip
Leader — Skip